topic Re: ISE enable password for cisco ASA in Network Access Control

ISE enable password for cisco ASA

Afi GNOC — Thu, 23 Aug 2018 23:43:14 GMT

Hi ;

i am deploying ISE and want to use same password for login and enable authentication on cisco ASA firewalls

1- when i donot configure enable password in ISE than it does not allow me to get into device configuration mode.

2- when i set enable password and if user change their passwords after 1st login than enable passwords dosent change and remain same.

i cannot see above issues with ACS and i am using ISE 2.3

Re: ISE enable password for cisco ASA

paul — Fri, 24 Aug 2018 03:16:17 GMT

If you are using the same password for enabled as the login why bother even doing the enable password. The ASA supports going right to # prompt just like other Cisco devices. Send the user right to the # prompt and do command authorization and accounting. The hold concept of enable mode is dated in my opinion especially when you have command authorization properly configured.

Re: ISE enable password for cisco ASA

anthonylofreso — Fri, 24 Aug 2018 11:52:57 GMT

I agree with Paul. I believe we used this process for TACACS config on ASA and ISE.

https://community.cisco.com/t5/security-documents/how-to-ise-tacacs-configuration-for-asa-network-devices/ta-p/3631056

Though this may not exactly align with what you're trying to do since it's primarily for role based access to ASDM.

Re: ISE enable password for cisco ASA

Afi GNOC — Fri, 24 Aug 2018 20:37:05 GMT

Below command helped me in solving the issue, i still cannot say its a perfect solution for firewalls (ASA) but it could be accepted as a way around, thank you for helping me in connecting the dots.

aaa authorization exec authentication-server auto-enable